Create topic permission table in upgrades

References #505

2 files changed, 20 insertions, 1 deletions

diff --git a/src/rabbit_access_control.erl b/src/rabbit_access_control.erl
index 3ae7d7f690..37b4e817e1 100644
--- a/src/rabbit_access_control.erl
+++ b/src/rabbit_access_control.erl
@@ -19,7 +19,7 @@
 -include("rabbit.hrl").
 
 -export([check_user_pass_login/2, check_user_login/2, check_user_loopback/2,
-         check_vhost_access/3, check_resource_access/3]).
+         check_vhost_access/3, check_resource_access/3, check_topic_access/4]).
 
 %%----------------------------------------------------------------------------
 
@@ -161,6 +161,18 @@ check_resource_access(User = #user{username       = Username,
          (_, Else) -> Else
       end, ok, Modules).
 
+check_topic_access(User = #user{username = Username,
+                                authz_backends = Modules},
+                            Resource, Permission, Context) ->
+    lists:foldl(
+        fun({Module, Impl}, ok) ->
+            check_access(
+                fun() -> Module:check_topic_access(
+                    auth_user(User, Impl), Resource, Permission, Context) end,
+                Module, "access to ~s refused for user '~s'",
+                [rabbit_misc:rs(Resource), Username]);
+            (_, Else) -> Else
+        end, ok, Modules).
 
 check_access(Fun, Module, ErrStr, ErrArgs) ->
     check_access(Fun, Module, ErrStr, ErrArgs, access_refused).
diff --git a/src/rabbit_upgrade_functions.erl b/src/rabbit_upgrade_functions.erl
index a53ad0c8f9..c2a1e49b32 100644
--- a/src/rabbit_upgrade_functions.erl
+++ b/src/rabbit_upgrade_functions.erl
@@ -58,6 +58,7 @@
 -rabbit_upgrade({operator_policies,     mnesia, [slave_pids_pending_shutdown, internal_system_x]}).
 -rabbit_upgrade({vhost_limits,          mnesia, []}).
 -rabbit_upgrade({queue_vhost_field,     mnesia, [operator_policies]}).
+-rabbit_upgrade({topic_permission,      mnesia,  []}).
 
 %% -------------------------------------------------------------------
 
@@ -564,6 +565,12 @@ user_password_hashing() ->
       end,
       [username, password_hash, tags, hashing_algorithm]).
 
+topic_permission() ->
+    create(rabbit_topic_permission,
+        [{record_name, topic_permission},
+         {attributes, [topic_permission_key, pattern]},
+         {disc_copies, [node()]}]).
+
 %%--------------------------------------------------------------------
 
 transform(TableName, Fun, FieldList) ->